From: Raspbian automatic forward porter Date: Thu, 8 Oct 2026 03:35:57 +0000 (+0100) Subject: Merge version 4:25.2.3-2+rpi1+deb13u7 and 4:25.2.3-2+deb13u8 to produce 4:25.2.3... X-Git-Tag: archive/raspbian/4%25.2.3-2+rpi1+deb13u8^0 X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=289b1ac1ecad53942974cc79493150b04b031d70;p=libreoffice.git Merge version 4:25.2.3-2+rpi1+deb13u7 and 4:25.2.3-2+deb13u8 to produce 4:25.2.3-2+rpi1+deb13u8 --- 289b1ac1ecad53942974cc79493150b04b031d70 diff --cc debian/changelog index b5f286bc5bf,66c2e10038e..0805ff29c25 --- a/debian/changelog +++ b/debian/changelog @@@ -1,19 -1,29 +1,46 @@@ - libreoffice (4:25.2.3-2+rpi1+deb13u7) trixie-staging; urgency=medium ++libreoffice (4:25.2.3-2+rpi1+deb13u8) trixie-staging; urgency=medium + + [changes brought forward from 1:6.0.2-1+rpi2 by Peter Michael Green at Fri, 27 Apr 2018 02:14:18 +0000] + * Disable testsuite. + + [changes introduced in 1:5.4.0-1+rpi1 by Peter Michael Green] + * Disable pdfium, it fails to build for armv6 + + [changes introduced in 1:7.2.4-3+rpi1 by Peter Michael Green] + * Use clang 11, newer versions cause armv7 contamination issues. + + [changes introduced in 4:24.2.5-1+rpi1 by Peter Michael Green] + * Build with gcc rather than clang. + * Disable skia. + - -- Raspbian forward porter Fri, 02 Oct 2026 10:51:47 +0000 ++ -- Raspbian forward porter Thu, 08 Oct 2026 03:35:54 +0000 ++ + libreoffice (4:25.2.3-2+deb13u8) trixie-security; urgency=medium + + * debian/patches/CVE-2026-63277.diff: fix CVE-2026-63277 + ("RCE on document open in Calc") + * debian/patches/do-not-load-exotic-protocols-for-document-supplied-data.diff: + fix CVE-2026-63270 environment / config disclosure via missing + exotic-protocol guards, also prerequisite for CVE-2026-62367 and + CVE-2026-63268 + * debian/patches/CVE-2026-63269-?.diff: fix CVE-2026-63269 local file read + + GET SSRF via GStreamer and HLS media + * debian/patches/CVE-2026-63267-?.diff: fix CVE-2026-63267 local file read + + GET SSRF via csv data provider + * debian/patches/CVE-2026-63268-?.diff: fix CVE-2026-63268 local file read + via sql sdbc:flat:file:// db href + * debian/patches/CVE-2026-63266-?.diff: fix + CVE-2026-63266 arbitrary file write via firebird backup + escalates to RCE + * debian/patches/firebird-db-connection.diff: backport from upstream, fix + db connection to firebird + debian/patches/firebird-module-path.diff, + debian/patches/firebird-call-writeFile-outside-the-SAL_WARN_IF-cond.patch: + backport from upstream to fix tests with Debian's patched firebird + * debian/source/include-binaries: add (changed by the build, 3.0->4.0?) + firebird_integer_ods12.odb and tdf132924.odb + + -- Rene Engelhard Sat, 03 Oct 2026 12:46:08 +0200 libreoffice (4:25.2.3-2+deb13u7) trixie-security; urgency=medium